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Independent Orbiter Assessment 
Analysis of the Elevon Subsystem FMEA/CIL 


1.0 EXECUTIVE SUMMARY 

The McDonnell Douglas Astronautics Company (MDAC) was selected in 
June 1986 to perform an Independent Orbiter Assessment (IOA) of 
the Failure Modes and Effects Analysis (FMEA) and Critical Items 
List ~ (CIL) . Direction was given by the STS Orbiter and GFE 
Projects Office to perform the hardware analysis using the 
instructions and ground rules defined in NSTS 22206. Instructions 
for Preparation of FMEA and CIL. 10 October 1986 . 

The IOA effort first completed an analysis of the Elevon Subsystem 
hardware, generating draft failure modes, and potential critical 
items. To preserve independence, this analysis was accomplished 
without reliance upon the results contained within the NASA 
FMEA/CIL documentation. The IOA results were then compared to 
the NASA FMEA/CIL baseline with proposed Post 51-L updates included. 
A resolution of each discrepancy from the comparison is provided 
through additional analysis as required. This report documents the 
results of that comparison for the Orbiter Elevon hardware. 

The IOA product for the Elevon analysis consisted of twenty-five 
failure mode /'worksheets" that resulted in seventeen potential 
critical items being identified. Comparison was made to the NASA 
FMEA/CIL, (as of 7 December 87) which consisted of (Note 1) 
twenty-three FMEAs and thirteen CIL items. The comparison 
determined if there were any results which had been found by the 
IOA but were not in the NASA baseline. This comparison produced 
agreement on all CIL items. Based on the Pre 51-L baseline, all 
non-CIL FMEAs were also in agreement. Based on discussions with 
the NASA subsystem manager, no additional non-CIL FMEAs are 
anticipated for the post 51-L update. Figure 1 presents a 
comparison of the proposed Post 51-L NASA baseline, with the IOA 
recommended baseline, and any issues. 

Note 1. The comparison and correlation of NASA FMEA Non-CIL 
items is based on the Pre 51-L baseline since all post 51-L FMEAs 
have not been received as the date of this report. 

The initial issues which were resolved arose due to NASA combining 
failures which had the same effect in one FMEA whereas IOA wrote a 
separate analysis for each failure. Minor issues such as fail or 
pass of screens did not effect the number of CIL items agreed to. 
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ELEVON ACTUATOR ASSESSMENT OVERVIEW 
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2 . 0 INTRODUCTION 


2 . 1 Purpose 

The 51-L Challenger accident prompted the NASA to readdress 
safety policies, concepts, and rationale being used in the 
National Space Transportation System (NSTS) . The NSTS 
Office has undertaken the task of reevaluating the FMEA/CIL for 
the Space Shuttle design. The MDAC is providing an independent 
assessment of the Orbiter FMEA/CIL reevaluation results for 
completeness and technical accuracy. 


2 . 2 Scope 

The scope of the independent FMEA/CIL assessment activity 
encompasses those Shuttle Orbiter subsystems and GFE hardware 
identified in the Space Shuttle Independent FMEA/CIL Assessment 
Contractor Statement of Work. Each subsystem analysis addresses 
hardware, functions, internal and external interfaces, and 
operational requirements for all mission phases. 


2.3 Analysis Approach 

The independent analysis approach is a top-down analysis 
utilizing as-built drawings to breakdown the respective subsystem 
into components and low-level hardware items. Each hardware item 
is evaluated for failure mode, effects, and criticality. These 
data are documented in the respective subsystem analysis report, 
and are used to assess the NASA and Prime Contractor FMEA/CIL 
reevaluation results. The IOA analysis approach is summarized in 
the following Steps 1.0 through 3.0. Step 4.0 summarizes the 
assessment of the NASA and Prime Contractor FMEAs/CILs that is 
performed and documented at a later date. 


Step 1.0 Subsystem Familiarization 

1.1 Define subsystem functions 

1.2 Define subsystem components 

1.3 Define subsystem specific ground rules and 
assumptions 

Step 2.0 Define subsystem analysis diagram 

2.1 Define subsystem 

2.2 Define major assemblies 

2.3 Develop detailed subsystem representations 

Step 3.0 Failure events definition 

3 . 1 Construct matrix of failure modes 

3 . 2 Document IOA analysis results 
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Step 4.0 Compare IOA analysis data to NASA FMEA/CIL 

4.1 Resolve differences 

4 . 2 Review in-house 

4 . 3 Document assessment issues 

4.4 Forward findings to Project Manager 


2.4 Ground Rules and Assumptions 

The ground rules and assumptions used in the IOA are defined in 
Appendix B. 


3.0 


SUBSYSTEM DESCRIPTION 

The following sections describe the elevon actuator system hardware. 
Each of the four elevon actuator systems (Figure 2) comprise the 
following components: a flow cutoff valve, switching valve, EH 

servoactuator , secondary pressure transducer, bypass valve, power 
valve, primary actuator, primary actuator delta pressure transducer, 
and primary actuator position transducer. 

3.1 Design and Function 

The elevon actuators are located at the trailing edge of the wing 
surface. The proper function of the elevons is essential during the 
dynamic flight phases of ascent and entry. During flight the 
Orbiter is controlled, in part, by four aerosurfaces called elevons. 
An elevon is a control surfact which performs the same functions as 
an elevator and an aileron on a conventional airplane. In the 
ascent phase of flight, the elevons are used for relieving high wing 
loads. For entry, the elevons are used to pitch and roll the 
vehicle. 

Each elevon actuator is driven by one primary actuator. Control of 
the actuator is provided by four EH servovalves. These servovalves 
are used to create a secondary delta pressure which controls the 
flow of hydraulic fluid to one power valve. This power valve, when 
actuated, diverts fluid to the primary actuator (Figure 3) . 

The flow cutoff valve (or low-pressure bypass valve) is used to 
circulate hydraulic fluid during certain thermally cold periods. 

The flow cutoff valve should be opened during circulation pump 
operations only. The flow cutoff valve must be closed during high- 
pressure operations or degraded elevon performance will result. 

The switching valve diverts pressure from one of the Orbiter 1 s three 
hydraulic systems to supply adequate fluid and pressure to the 
primary and secondary elevon hydraulic system. The switching valve 
(Figure 4) contains two pistons, a primary and a secondary. If the 
pressure in the primary Orbiter hydraulic sytem drops below 1200 to 
1500 psi, the switching valve primary piston will translate and 
allow the secondary hydraulic system to provide the required fluid 
and pressure to the downstream actuators. If the second hydraulic 
system is unable to provide pressure above 1200 to 1500 psi, the 
second switching valve piston will translate allowing the third 
hydraulic system to provide pressure to the actuator and 
servovalves. Linear Variable Differential Transformers (LVDTs) 
attached to the switching valve pistons indicate to the crew which 
hydraulic system is powering the elevon. 
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The many small passages, orifices, and restrictions in the secondary 
side of the servovalve assembly are highly sensitive to 
contaminants which enter the hydraulic sytem. A 15 micron filter 
conditions the hydraulic fluid which supplies the secondary side 
of the actuation system. 

The elevon bypass valve is used to isolate an erroneous servovalve 
output from influencing the power valve movement. If secondary 
delta pressure exceeds 2200 psi for 120 milliseconds, the bypass 
valve diverts fluid away from the power spool to the return, 
preventing the erroneous or failed channel from creating a potential 
force-flight or incorrectly influencing power spool and elevon 
motion . 

The secondary delta pressure transducers are used to measure the 
instantaneous pressure differential between the hydraulic source 
(nominally 3000 psi) and the servovalve reduced pressure. The 
transducer comprises a dual-spring balanced piston and a LVDT 
which transmits a transducer piston position in the form of a 
voltage to the Aerosurface Servo Amplifier (ASA) . The ASA can 
use this voltage to determine the delta pressure across the 
corresponding servovalve. This information is used to bias 
equalization of four servovalve channels and activate their 
corresponding bypass valves when a channel cutoff is required. 

The power valve combines four servovalve induced secondary delta 
pressures into a translation representing the commanded elevon 
movement. As the power valve moves, it allows a primary pressure to 
translate the primary actuator and its corresponding elevon. When 
one of the four secondary pressures are bypassed or erroneous, the 
remaining three pressures will overdrive the power valve. 

The primary actuator is responsible for the ultimate motion of the 
elevon. It is controlled by a secondary pressure power valve which 
diverts primary hydraulic fluid and pressure to the actuator 
(Figure 5) . 

The primary delta pressure transducer is used to measure the 
instantaneous pressure differential across the primary actuator. 

The transducer comprises a dual-spring balanced piston and a LVDT 
which transmits a transducer piston position in the form of a 
voltage to the ASA. The ASA uses this voltage to determine the 
delta pressure across the primary actuator. 

The position feedback transducer feeds the instantaneous position of 
the elevon to the ASA and General Purpose Computers (GPCs) . The 
transducer consists of a LVDT calibrated to feedback a position 
voltage to the ASA. This information is used by the ASA for 
servovalve biasing and to the GPCs for Flight Control System (FCS) 
and caution and warning inputs. The current elevon position is 
displayed to the crew on the surface position indicators on Panel 
F7 . 
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3.2 Interfa ce s and Locations 

The elevon system hardware is located at the trailing edge of the 
Orbiter's wings. The elevon system interfaces with the Orbiter's 
three hydraulic systems, each corresponding to one Auxiliary Power 
Unit (APU) . The elevon system hardware interfaces with the ASAs 
which in turn interface with the FCS portion of the GPCs for system 
control, fault detection, actuation and feedback. 

3.3 Hierarchy 

Figure 2 illustrates the hierarchy of the Elevon hardware and 
the corresponding subcomponents. Figures 3 through 5 comprise 
the detailed system representations. 



Figure 2 - ELEVON SUBSYSTEM OVERVIEW 
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Figure 4 - SWITCHING VALVE 
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4 . 0 ASSESSMENT RESULTS 


The IOA analysis of the elevon actuator hardware initially generated 
twenty-five failure inodes worksheets and identified seventeen 
Potential Critical Items (PCIs) before starting the assessment 
process. No additional failure mode worksheets were generated 
during the comparison. The analysis results were compared to the 
proposed NASA Post 51-L baseline of (Note 1) twenty-three FMEAs 
and thirteen CIL items. Upon completion of the assessment all of 
the IOA and NASA failure modes were in agreement. 

Note 1. Only Post 51-L NASA CIL items have been received; all 
Post 51-L NASA FMEAs were not received as of this report date. 
Non-CIL items comparison was based on review of NASA Pre 51-L 
baseline and the IOA analysis. 


Appendix C presents the detailed assessment worksheets for each 
failure mode identified and assessed. Appendix D highlights the 
NASA critical items and corresponding IOA worksheet ID. Appendix 
E contains IOA analysis worksheets supplementing previous 
analysis results reported in STS Engineering and Operations 
Support (STSEOS) Working Paper 1. 0-SP-VA86001-25, Analysis of the 
ELevon, 3 December 1986. No supplemental analysis worksheets 
were generated for the Elevon assessment. Appendix F provides a 
cross-reference between the NASA FMEA and corresponding IOA 
worksheets. IOA recommendations are also summarized. 

A summary of the quantity of NASA FMEAs assessed, versus the 
recommended IOA baseline, and any issues identified is presented in 
Table I. 


TABLE I Summary of 

IOA FMEA Assessment 

Component 

NASA 

IOA 

Issues 

o Primary Actuator 

6 

6 

0 

o Check Valve 

2 

2 

0 

o Primary Delta P X-DCER 

2 

2 

0 

o Primary Feedback X-DCER 

1 

1 

0 

o Switch Valve Assembly 
o Switch Valve 

2 

2 

0 

o Flow Control Valve 

2 

2 

0 

o Filter 

1 

1 

0 

o Servovalve Assembly 
o E-H Servovalve 

3 

3 

0 

o Bypass Valve 

2 

2 

0 

o Sec. Delta P X-DCER 

1 

1 

0 

o Power Valve 

1 

1 

0 

TOTAL 

23 

23 

0 
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A summary of the quantity of NASA CIL items assessed, versus the 
recommended IOA baseline, and any issues identified is presented 
in Table II. 


TABLE II Summary of 

IOA CIL Assessment 

Component 



ISSUES 

o Primary Actuator 

2 

2 

0 

o Check Valve 

2 

2 

0 

o Primary Delta P X-DCER 

1 

1 

0 

o Primary Feedback X-DCER 

1 

1 

0 

o Switch Valve Assembly 
o Switch Valve 

2 

2 

0 

o Flow Control Valve 
o Filter 

1 

1 

0 

o Servovalve Assembly 
o E-H Servovalve 

2 

2 

0 

o Bypass Valve 
o Sec. Delta P X-DCER 

1 

1 

0 

o Power Valve 

1 

1 

0 

TOTAL 

13 

13 

0 
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Table III presents a summary of the IOA recommended failure 
criticalities for the Post 51-L FMEA baseline. Further 
discussion of each of these subdivisions and the applicable 
failure modes is provided in subsequent paragraphs. 


TABLE III Summary of 

IOA Recommended Failure Criticalities 

Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

o Primary Actuator 

2 




1 

3 

6 

o Check Valve 

1 

1 





2 

o Primary Delta 








P X-DCER 




2 



2 

o Primary Feed- 








back X-DCER 

1 






i 

o Switch Vlv Assy 








o Switch Valve 

1 

1 





2 

o Flow Cntrl Vlv 






2 

2 

o Filter 

1 






1 

o Servovalve Assy 








o E-H Servovalve 


2 




1 

3 

o Bypass Valve 




2 



2 

o Sec. Delta P 








X-DCER 


1 





1 

o Power Valve 

1 






1 

TOTAL 

7 

5 


4 

1 

6 

23 
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Of the failure inodes analyzed, 17 failures were determined to 
be critical items . A summary of the IOA recommended critical 
items is presented in Table IV. 


TABLE IV Summary of 

IOA Recommended Failure Criticalities 

Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

o Primary Actuator 

2 




1 


3 

o Check Valve 
o Primary Delta 

1 

1 





2 

P X-DCER 








o Primary Feed- 








back X-DCER 

1 






i 

o Switch Vlv Assy 








o Switch Valve 
o Flow Cntrl Vlv 

1 

1 





2 

o Filter 

1 






1 

o Servovalve Assy 








o E-H Servovalve 
o Bypass Valve 
o Sec. Delta P 


2 





2 

X-DCER 


1 





1 

o Power Valve 

1 






1 

TOTAL 

7 

5 



1 
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The scheme of assigning IOA assessment (Appendix C) and analysis 
(Appendix E) worksheet numbers is shown in Table V. 


TABLE V IOA Worksheet Number 


Component 

IOA ID 

Number 




Primary actuator 

Elevon 

-106, 

, 107, 

117, 

118, 

119 


120, 

121, 

122, 

123, 

124, 

125 

Switch Valve Assembly 

Elevon 

-101, 

102, 

103, 

104, 

105 

Servovalve Assembly 

Elevon 

-109, 

, 110, 

111, 

112, 

113 


114, 

115, 

116 
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4 . 1 Primary Actuator 

Failures which were related to the Elevon actuator as an entity 
were analyzed. Critical failures were the loss of hydraulic fluid 
due to gross and slow leaks. There failures were caused by 
component rupture, manifold leaks, cylinder and actuator body 
fractures and seal leaks. Other critical failures were associated 
with mechanical failures of the ram/piston assembly. The loss of 
the four primary feedback transducers due to mechanical failure of 
the gauged linkage also resulted in a critical failure. 

4.2 Switch Valve Assembly 

Components of the assembly were individually analyzed. The most 
critical failures were associated with contaminated hydraulic 
fluid which restricted fluid flow, clogged filters and jammed 
valves which resulted in failure to switch hydraulic sources and 
to prevent fluid flow through a check valve to the main drive 
piston. 

4 . 3 Servovalve Assembly 

The worst critical failures were caused by 1) hydraulic fluid 
contaminated which caused the main power alve to jam open or 
closed, and 2) rupture of the power valve housing due to fatigue 
which caused loss of all hydraulic fluid with associated loss of 
actuator control. Loss of command signal input, jammed valve and 
fractured flapper valve caused loss of a servovalve; however the 
three remaining servovalves overdrive the failed servovalve 
providing nominal control. 

4.4 Failure Comparison 

The reason for the IOA showing more CIL items than NASA was due to 
the fact that IOA wrote failure sheets for each item whereas NASA 
combined failures. Review of the NASA CIL items showed that all 
of IOA failures had been analyzed. Since the combined failures 
all resulted in the same effect it was concluded that there were 
no issues with the IOA failures. Minor differences such as pass 
or fail of screens were readily resolved. Frequent discussions 
with the subsystem manager resulted in a better understanding of 
the system and component operation. As a result of these 
discussions, several IOA criticalities were downgraded. 
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8. SD72-SH-0102-6: Requirements/Definition Document 

Hydraulic Subsystem 

Rockwell International, SDM Baseline, 
January 3, 1977 
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APPENDIX A 
ACRONYMS 


APU 

- 

Auxiliary Power Unit 

ASA 

- 

Aerosurface Servo Amplifier 

ASSY 

- 

Assembly 

CIL 

- 

Critical Items List 

EH 

- 

Electro-Hydraulic 

FCS 

- 

Flight Control System 

FM 

- 

Failure Mode 

FMEA 

— 

Failure Modes and Effects Analysis 

F 

- 

Functional 

GFE 

- 

Government Furnished Equipment 

GPC 

- 

General Purpose Computer 

HW 

- 

Hardware 

IOA 

- 

Independent Orbiter Assessment 

LVDT 

- 

Linear Variable Differential Transformer 

MDAC 

- 

McDonnell Douglas Astronautics Company 

NA 

- 

Not Applicable 

NASA 

- 

National Aeronautics and Space Adminstration 

NSTS 

- 

National Space Transportation System 

PCI 

- 

Potential Critical Item 

psi 

- 

Pounds Per Square Inch 

psid 

- 

Pounds Per Square Inch Differential 

RI 

- 

Rockwell International 

VLV 

- 

Valve 

xducer 

- 

Transducer 
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DEFINITIONS , GROUND RULES, AND ASSUMPTIONS 


B.l Definitions 

B.2 Project Level Ground Rules and Assumptions 
B.3 Subsystem-Specific Ground Rules and Assumptions 



APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.l Definitions 

Definitions contained in NSTS 22206, Instructions For Preparation 
of FMEA/CIL. 10 October 1986 . were used with the following 
amplifications and additions. 

INTACT ABORT DEFINITIONS: 

RTT-q - begins at transition to OPS 6 and ends at transition 
to OPS 9, post-flight 

TAL - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

AOA - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

ATO - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

credible ( CAUSE) - an event that can be predicted or expected in 
anticipated operational environmental conditions. Excludes an 
event where multiple failures must first occur to result in 
environmental extremes 

CONTINGENCY CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

EARLY MISSION TERMINATION - termination of onorbit phase prior to 
planned end of mission 

EFFECTS /rationale - description of the case which generated the 
highest criticality 

HIGHEST CRITICALITY - the highest functional criticality 
determined in the phase-by-phase analysis 

MAJOR MODE (MM1 - major sub-mode of software operational sequence 
(OPS) 

MC - Memory Configuration of Primary Avionics Software System 
(PASS) 

MISSION - assigned performance of a specific Orbiter flight with 
payload/objective accomplishments including orbit phasing and 
altitude (excludes secondary payloads such as GAS cans, 
middeck P/L, etc.) 
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MULTIPLE ORDER FAILURE - describes the failure due to a single 
cause or event of all units which perform a necessary (critical) 
function 

OFF-NOMINAL CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

OPS - software operational sequence 

PRIMARY MISSION OBJECTIVES - worst case primary mission objec- 
tives are equal to mission objectives 

PHASE DEFINITIONS: 

PRELAUNCH PHASE - begins at launch count-down Orbiter 
power-up and ends at moding to OPS Major Mode 102 (liftoff) 

LIFTOFF MISSION PHASE - begins at SRB ignition (MM 102) and 
ends at transition out of OPS 1 (Synonymous with ASCENT) 

ONORBIT PHASE - begins at transition to OPS 2 or OPS 8 and 
ends at transition out of OPS 2 or OPS 8 

DEORBIT PHASE - begins at transition to OPS Major Mode 
301 and ends at first main landing gear touchdown 

LANDING/SAFING PHASE - begins at first main gear 
touchdown and ends with the completion of post-landing 
safing operations 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B. 2 IOA Project Level Ground Rules and Assumptions 

The philosophy embodied in NSTS 22206. Instructions for 
Preparation of FMEA/CIL. 10 October 1986 . was employed with the 
following amplifications and additions. 


1. The operational flight software is an accurate 
implementation of the Flight System Software Requirements 
(FSSRs) . 

RATIONALE: Software verification is out-of-scope of 
this task. 

2. After liftoff, any parameter which is monitored by system 
management (SM) or which drives any part of the Caution and 
Warning System (C&W) will support passage of Redundancy 
Screen B for its corresponding hardware item. 

RATIONALE: Analysis of on-board parameter availability 
and/or the actual monitoring by the crew 
is beyond the scope of this task. 

3. Any data employed with flight software is assumed to be 
functional for the specific vehicle and specific mission 
being flown. 

RATIONALE: Mission data verification is out-of-scope of 
this task. 

4. All hardware (including firmware) is manufactured and 
assembled to the design specifications/drawings. 

RATIONALE: Acceptance and verification testing is 

designed to detect and identify problems 
before the item is approved for use. 

5. All Flight Data File crew procedures will be assumed 
performed as written, and will not include human error in 
their performance. 

RATIONALE: Failures caused by human operational error 
are out-of-scope of this task. 
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6 . 


All hardware analyses will, as a minimum, be performed at 
the level of analysis existent within NASA/Prime Contractor 
Orbiter FMEA/CILs, and will be permitted to go to greater 
hardware detail levels but not lesser. 

RATIONALE: Comparison of IOA analysis results with 

other analyses requires that both analyses 
be performed to a comparable level of 
detail . 

7. Verification that a telemetry parameter is actually 
monitored during AOS by ground-based personnel is not 
required. 

RATIONALE: Analysis of mission-dependent telemetry 

availability and/or the actual monitoring of 
applicable data by ground-based personnel is 
beyond the scope of this task. 

8. The determination of criticalities per phase is based on the 
worst case effect of a failure for the phase being analyzed. 
The failure can occur in the phase being analyzed or in 

any previous phase, whichever produces the worst case 
effects for the phase of interest. 

RATIONALE: Assigning phase criticalities ensures a 
thorough and complete analysis. 

9. Analysis of wire harnesses, cables, and electrical connectors 
to determine if FMEAs are warranted will not be performed 
nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

10. Analysis of welds or brazed joints that cannot be inspected 
will not be performed nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

11. Emergency system or hardware will include burst discs and 
will exclude the EMU Secondary Oxygen Pack (SOP) , pressure 
relief valves and the landing gear pyrotechnics. 

RATIONALE: Clarify definition of emergency systems to 
ensure consistency throughout IOA project. 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.3 Elevon-Specif ic Ground Rules and Assumptions 

The IOA analysis was performed to the component or assembly level 
of the Elevon subsystem. The analysis considered the worst case 
effects of the hardware or functional failure on the subsystem, 
mission, and crew and vehicle safety. 


APPENDIX C 
DETAILED ASSESSMENT 

This section contains the IOA assessment worksheets generated 
during the Assessment of the Elevon Actuator Subsystem. The 
information on these worksheets facilitates the comparison of the 
NASA FMEA/CIL (Pre and Post 51-L) to the IOA detailed analysis 
worksheets included in Appendix E. Each of these worksheets 
identifies the NASA FMEA being assessed, corresponding MDAC 
Analysis Worksheet ID (Appendix E) , hardware item, criticality, 
redundancy screens, and recommendations. For each failure mode, 
the highest assessed hardware and functional criticality is 
compared and discrepancies noted as "N" in the compare row under 
the column where the discrepancy occurred. 


LEGEND FOR IOA ASSESSMENT WORKSHEETS 


Hardware Criticalities: 

1 - Loss of life or vehicle 

2 - Loss of mission or next failure of any redundant item 

(like or unlike) could cause loss of life/vehicle 

3 * All others 

Functional Criticalities: 

1R »■ Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of life or vehicle 
2R » Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of mission 

Redundancy Screens A, B and C: 

P * Passed Screen 
F * Failed Screen 
NA * Not Applicable 

NASA Data : 

Baseline - NASA FMEA/CIL 

New * Baseline with Proposed Post 51-L Changes 

CIL Item : 

X - Included in CIL 
Compare Row : 

N ■ Non compare for that column (deviation) 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 

SUBSYSTEM: 

MDAC ID: 

ITEM: 


12/20/87 

ELEVON-101 

02-6-C01-C11 

ELEVON 

101 

FLOW CUTOFF VALVE 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS 

FLIGHT 

HDW/FUNC ABC 


CIL 

ITEM 


NASA [3/3 ] [ NA] [ NA] [ NAJ 

IOA [3/3 ] [ NA] [ NA] [ NA] 


[ ] * 

[ ] 


COMPARE [ / 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] [ ] 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 

SUBSYSTEM: 

MDAC ID: 

ITEM: 


12/20/87 

ELEVON-102 

02-6-C01-C12 

ELEVON 

102 

FLOW CUTOFF VALVE 


NASA DATA: 
'BASELINE [ X ] 
NEW [ ] 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY SCREENS 

CIL 


FLIGHT 

HDW/FUNC 

A 

B 

c 

ITEM 

NASA 

[3/3 ] 

[ NA] 

[ NA] 

[ NA] 

[ 3 * 

IOA 

[3/3 ] 

[ NA] 

[ NA] 

[ NA] 

[ 3 

COMPARE 

[ / ] 

[ 3 

[ 3 

[ 3 

[ 3 

RECOMMENDATIONS : (If 

different 

from NASA) 



[ / ] 

[ 3 

[ 3 

[ 3 

[ 3 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/20/87 

ELEVON-103 

02-6-C01-SW-C06 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

103 

SWITCHING VALVE 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY 

SCREENS 

CIL 


FLIGHT 





ITEM 


HDW/FUNC 

A 

B 


C 


NASA 

[ 2 /1R ] 

[ P 3 [ 

P 

] 

[ P 3 

[ X ] * 

IOA 

[ 2 /1R ) 

[ P ] [ 

P 

] 

C P 3 

[ x ] 

COMPARE 

[ / ] 

[ 3 [ 


] 

C 3 

[ 3 

RECOMMENDATIONS : (If 

different 

from 

NASA) 



[ / ] 

[ 3 [ 


] 

[ 3 

C 3 

t a / r\T?T T?nnt? \ 


(ADD/DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. THIS IOA FMEA WAS WRITTEN 
SPECIFICALLY FOR THE SWITCHING VALVE. NOTE: IOA FMEA NO. 125 
COVERS THE SAME NASA FMEA BUT FOR THE SERVO ACTUATOR. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/20/87 

ELEVON-104 

02-6-C01-SW-C02 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

104 

SWITCHING VALVE 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY 

FLIGHT 

HDW/FUNC 


REDUNDANCY SCREENS 
ABC 


CIL 

ITEM 


NASA [ 2 /1R ] [ P ] [ F ] [ P ] 

IOA [ 2 /1R ] [ P ] [ P ] [ P ] 


[ X ] * 

[ X ] 


COMPARE [ / ] [ 3 [ N 


3 


RECOMMENDATIONS: (If different from NASA) 

[ / 3 [][][•] [ 3 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 

SUBSYSTEM: 

MDAC ID: 

ITEM: 


12/20/87 
E LEVON-105 
02-6-C01-A01 

ELEVON 

105 

SWITCHING VALVE 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS 

FLIGHT 

HDW/FUNC ABC 


CIL 

ITEM 


NASA [ 1 /I ] [ NA] [ NA] [ NA] 

IOA [1/1 ] [ NA] [ NA] [ NA] 


[ X ] * 
[ X ] 


COMPARE [ / 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] [3 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. THIS IOA FMEA WAS WRITTEN FOR 
COMPONENT RUPTURES DOWNSTREAM OF THE SWITCHING VALVE. NOTE IOA 
FMEA NO. 115 COVERS THE SAME NASA FMEA BUT FOR THE POWER VALVE. 
NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/20/87 

ELEVON-106 

02-6-C01-CV-C08 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

106 

CHECK VALVE 


LEAD ANALYST: 


R. WILSON 


ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

C 


NASA [1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x 

IOA [1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x 

COMPARE [ / ] 

[ ] 

[ 1 

[ ] 

C 

RECOMMENDATIONS : (If 

different 

from NASA) 


[ / 3 

[ ] 

[ ] 

[ ] 

[ 


(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/20/87 

ELEVON-107 

02-6-C01-CV-C09 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

107 

CHECK VALVE 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY SCREENS 

CIL 


FLIGHT 

HDW/FUNC 

A 

B 

C 

ITEM 

NASA 

[ 2 /1R ] 

[ F ] 

[ F ] 

[ P ] 

[ X ] * 

IOA 

[ 2 /1R ] 

[ P ] 

[ F ] 

C P ] 

[ x ] 

COMPARE 

[ / ] 

[ N ] 

[ ] 

C 3 

[ ] 

RECOMMENDATIONS : (If 

different 

from NASA) 



[ / ] 

[ ] 

[ ] 

[ ] 

[ ] 





(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS z 

CONCUR WITH NASA ANALYSIS. WOULD REQUIRE TWO FAILURES TO RESULT 
IN A LOSS OF LIFE/VEHICLE. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/20/87 

ELEVON-108 

02-6-C01-FE-B08 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

108 

FILTER - 15 MICRON 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

C 


NASA [1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x 

IOA [1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x 


COMPARE [ / 


3 


RECOMMENDATIONS : 

[ / 


(If different from NASA) 

[ ] [ 1 [ 


[ 3 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/20/87 

ELEVON-109 

02-6-C01-SV-B01 


NASA DATA: 
BASELINE [ ] 

NEW t X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

109 

SERVO VALVE 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY 

SCREENS 

CIL 


FLIGHT 

HDW/FUNC 

A 

B 


c 

ITEM 

NASA 

[ 2 /1R ] 

[ P 3 

[ F 

3 

[ P 3 

[ X ] * 

IOA 

[ 2 /1R ] 

[ P 3 

[ P 

3 

[ P 3 

[ X ] 

COMPARE 

[ / 1 

[ 3 

[ N 

3 

[ 3 

[ 3 

RECOMMENDATIONS : (If 

different 

from 

NASA) 



[ / 3 

[ 3 

[ 

3. 

C 3 

[ 3 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/20/87 NASA DATA: 

ASSESSMENT ID: ELEVON-110 BASELINE [ X ] 

NASA FMEA #: 02-6-C01-A03 NEW [ ] 

SUBSYSTEM: ELEVON 

MDAC ID: 110 

ITEM: SERVO VALVE 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY SCREENS 

CIL 


FLIGHT 




ITEM 

" " 

HDW/FUNC 

A 

B 

C 



NASA [ 3 /3 ] 

[ NA] 

[ NA] 

[ NA] 

[ 


IOA [3/3 ] 

[ NA] 

[ NA] 

[ NA] 

[ 

E 

COMPARE [ / ] 

[ ] 

[ 1 

[ ] 

[ 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [ ] [ ] [ ] [ ] 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. THIS IOA FMEA COVERS THE ELEVON SERVO 
VALVE. IOA FMEA NO. 120 COVERS THE SAME FAILURE MODE (INTERNAL 
LEAKAGE) BUT FOR THE PRIMARY ACTUATOR. IOA ANALYSIS BROKE THE 
ELEVON HARDWARE TO A LOWER LEVEL THAN THE NASA ANALYSIS. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/20/87 
ASSESSMENT ID: ELEVON-111 

NASA FMEA #: 02-6-C01-SV-B02 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

111 

SERVO VALVE RESTRICTOR 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 



CRITICALITY 

REDUNDANCY 

SCREENS 



FLIGHT 






HDW/FUNC 

A 

B 

C 


NASA 

[ 2 /1R ] 

[ P ] 

( F 

] [ P 

] 

IOA 

C 2 /1R ] 

[ P ] 

[ F 

] [ P 

] 


CIL 

ITEM 


[ X ] * 

[ X ] 


COMPARE [ / 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] [ ] 

(ADD/DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS l 

SERVO VALVE RES TRIC TOR PLUGS AND CAUSES AN IMBALANCE IN THE SERVO 
VALVE. THREE REMAINING SERVO VALVES OPERATE THE POWER SPOOL. 
CONCUR WITH NASA. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/20/87 
ASSESSMENT ID: ELEVON-112 

NASA FMEA #: 02-6-C01-B03 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


^SUBSYSTEM: 
MDAC ID: 
_ITEM: 

LEAD ANALYST: 


ELEVON 

112 

BYPASS VALVE 
R. WILSON 


ASSESSMENT: 


CRITICALITY 

FLIGHT 

HDW/FUNC 


REDUNDANCY SCREENS 
ABC 


CIL 

ITEM 


NASA [ 3 /1R ] [ P ] [ P ] [ P ] 

IOA [ 2 /1R ] [ P ] [ P ] [ P ] 


[ X ] * 
[ X ] 


COMPARE [ N / 


3 


RECOMMENDATIONS: (If different from NASA) 

- -[■/.] [][][] [ ] 

(ADD/DELETE) 

_* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

“CONCUR WITH NASA ANALYSIS. NO ISSUE. TAKES 3 FAILURES; SERVO- 
~VALVE THEN BYPASS VALVE AND ANOTHER SERVO-VALVE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/20/87 
ASSESSMENT ID: ELEVON-113 

NASA FMEA #: 02-6-C01-B03 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

113 

BYPASS VALVE FILTER-100 MICRON 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY 

SCREENS 

CIL 


FLIGHT 

HDW/FUNC 

A 

B 


C 

ITEM 

NASA 

[ 3 /1R ] 

[ P ] 

[ P 

] 

[ P ] 

[ ] * 

IOA 

[ 2 /1R ] 

[ P ] 

[ F 

] 

[ P ] 

[ x ] 

COMPARE 

[ N / ] 

[ ] 

[ N 

] 

C ] 

[ N ] 

RECOMMENDATIONS : (If 

different 

from 

NASA) 



C / ] 

[ ] 

[ 

] 

( ] 

[ ] 

(ADD/DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS • 

A PLUGGED FILTER WOULD PREVENT THE BYPASS VALVE FROM BYPASSING AN 
ERRONEOUS CHANNEL. THE REMAINING THREE CHANNELS WOULD OVERDRIVE 
THE BAD CHANNEL. THIS ASSESSMENT IS COVERED BY NASA FMEA/CIL 02- 
6-C01-B03 (INCLUDES OTHER FAILURES MODES) . SAME EFFECT 
AS MDAC ID 112. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/20/87 

ELEVON-114 

02-6-C01-PP-A06 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

114 

SECONDARY DELTA PRESSURE TRANSDUCER 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 



CRITICALITY 

REDUNDANCY 

SCREENS 

CIL 


FLIGHT 

HDW/FUNC 

A 

B 



C 

ITEM 

NASA 

C 2 /1R ] 

[ P ] 

[ F 

3 

[ 

P 3 

[ X ] * 

IOA 

[ 2 /1R ] 

[ P ] 

[ P 

3 

[ 

P 3 

[ X ] 

COMPARE 

[ / ] 

[ 3 

[ N 

3 

[ 

3 

[ 3 

RECOMMENDATIONS : (If 

different 

from 

NASA) 




[ / ] 

[ 3 

[ 

3 

[ 

3 

[ 3 

/ X r\r\ / TM7T TTTTVrP \ 


(ADD/DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/20/87 
ASSESSMENT ID: ELEVON-115 

NASA FMEA #: 02-6-C01-A01 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 

ITEM: 

LEAD ANALYST: 


ELEVON 

115 

POWER VALVE 
R. WILSON 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS 

FLIGHT 

HDW/FUNC ABC 


CIL 

ITEM 


NASA [ 1 /I ] [ NA] [ NA] [ NA] 

IOA [1/1 ] [ NA] [ NA] [ NA] 


[ X ] * 
[ X ] 


COMPARE [ / 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] [ ] 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. THIS IOA FMEA WAS WRITTEN FOR THE 
RUPTURE OF THE POWER VALVE. NOTE - IOA FMEA NO. 105 COVERS THE 
SAME NASA FMEA FOR OTHER COMPONENTS DOWNSTREAM OF THE SWITCHING 
VALVE. NO ISSUE. AGREE TO INCORPORATE UNDER ONE FMEA. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/20/87 

ELEVON-116 

02-6-C01-PV-B05 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

116 

POWER VALVE 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 


C 

ITEM 

NASA 

[1/1 ] 

[ NA] [ 

NA] 

[ 

NA] 

[ x 

IOA 

[1/1 ] 

[ NA] [ 

NA] 

[ 

NA] 

[ x 

COMPARE 

[ / 1 

[ ] [ 

] 

[ 

] 

[ 

RECOMMENDATIONS : 

(If different 

from 

NASA) 




[ / ] 

[ ] [ 

] 

[ 

] 

[ 


(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/20/87 
ASSESSMENT ID: ELEVON-117 

NASA FMEA #: 02-6-C01-C06 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

117 

PRIMARY ACTUATOR 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY SCREENS 

CIL 


FLIGHT 




ITEM 


HDW/FUNC 

A 

B 

c 


NASA 

C 3 /2R ] 

[ P ] 

[ F ] 

[ p ] 

[ X ] * 

IOA 

[1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ X ] 

COMPARE 

[ N /N ] 

[ N ] 

[ N ] 

[ N ] 

[ ] 

RECOMMENDATIONS : (If 

different 

from 

NASA) 



[ / 3 

C ] 

[ ] 

[ ] 

[ ] 






(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. NO ISSUE. BUILT IN BARRIER SEAL 
PREVENTS RAPID LOSS OF HYDRAULIC FLUID. CAN STILL MAINTAIN 
ACTUATOR CONTROL. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/20/87 

ELEVON-118 

02-6-C01-PP-A07 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: ELEVON 

MDAC ID: 118 

ITEM: LVDT 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 

CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 

C 

ITEM 

NASA 

[ 1 /l ] 

[ NA] 

[ NA] 

[ NA] 

[ X ] 

IOA 

[1/1 1 

[ NA] 

[ NA] 

[ NA] 

[ X ] 

COMPARE 

[ / ] 

[ ] 

[ ] 

[ ] 

[ ] 

RECOMMENDATIONS : 

(If different 

from NASA) 



[ / ] 

[ ] 

[ 1 

[ ] 

[ ] 


(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/20/87 
ASSESSMENT ID: ELEVON-119 

NASA FMEA #: 02-6-C01-A02 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

119 

PRIMARY ACTUATOR 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 


CRITICALITY 

FLIGHT 

HDW/FUNC 

NASA [1/1 ] 

IOA [1/1 ] 

COMPARE [ / ] 


REDUNDANCY SCREENS 


A 

B 


c 

NA] 

[ NA] 

[ 

NA] 

NA] 

[ NA] 

[ 

NA] 

] 

[ ] 

[ 

] 


CIL 

ITEM 


[ X ] * 
[ X ] 

[ 3 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] [ ] 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS * 

CONCUR WITH NASA ANALYSIS. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/20/87 
ASSESSMENT ID: ELEVON-120 

NASA FMEA #: 02-6-C01-A03 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

120 

PRIMARY ACTUATOR 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 

CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 


c 

ITEM 

NASA 

[3/3 ] 

[ NA) [ 

NA] 

[ 

NA] 

[ ] * 

IOA 

[3/3 ] 

[ NA] [ 

NA] 

C 

NA] 

[ ] 

COMPARE 

[ / ] 

C ] [ 

] 

[ 

] 

[ ] 

RECOMMENDATIONS : 

(If different 

from 

NASA) 




[ / 3 

[ ] C 

] 

c 

] 

[ ] 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS : 

CONCUR WITH NASA ANALYSIS. THIS IOA FMEA COVERS THE ELEVON 
PRIMARY ACTUATOR. IOA FMEA NO. 110 COVERS THE SAME FAILURE MODE 
(INTERNAL LEAKAGE) BUT FOR THE SERVO VALVE. IOA ANALYSIS BROKE 
THE ELEVON HARDWARE TO A LOWER LEVEL THAN THE NASA ANALYSIS. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/20/87 
ASSESSMENT ID: ELEVON-121 

NASA FMEA #: 02-6-C01-A04 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

121 

PRIMARY DELTA PRESSURE TRANSDUCER 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

FLIGHT 




HDW/FUNC 

A 

B 

C 

NASA [ 3 /1R ] 

[ P ] 

[ P ] 

[ P ] 

IOA [ 3 /1R ] 

[ P ] 

[ P ] 

[ P ] 

COMPARE [ / ] 

[ ] 

[ 1 

[ ] 


RECOMMENDATIONS: (If different from NASA) 


C / ] [][][] 


CIL 

ITEM 


C ] * 

[ ] 

[ ] 


[ ] 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 


REMARKS I 

CONCUR WITH NASA ANALYSIS. REQUIRES TWO OF FOUR TRANSDUCER 
OUTPUTS FOR FAULT DETECTION DURING NULL FLIGHT PERIODS. NO 


ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/20/87 
ASSESSMENT ID: ELEVON-122 

NASA FMEA #: 02-6-C01-B07 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

122 

PRIMARY ACTUATOR DELTA PRESSURE TRANSDUCER 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 



CRITICALITY 

REDUNDANCY SCREENS 

CIL 


FLIGHT 

HDW/FUNC 

A 

B C 

ITEM 

NASA 

C 3 /1R ] 

[ P ] 

[ P ] [ P ] 

[ ] * 

IOA 

[ 3 /1R ] 

[ P ] 

C p ] C P ] 

C ] 

COMPARE 

[ / ] 

[ ] 

[ ] [ ] 

[ ] 

RECOMMENDATIONS : (If 

different 

from NASA) 



[ / 1 

[ ] 

[ 1 [ ] 

[ ] 

(ADD/DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE [ 
INADEQUATE [ 


] 

] 


CONCUR WITH NASA ANALYSIS. REQUIRES TWO OF FOUR TRANSDUCER 
OUTPUTS FOR FAULT DETECTION DURING NULL FLIGHT PERIODS. NO 


ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 

SUBSYSTEM: 

MDAC ID: 

ITEM: 

LEAD ANALYST: 
ASSESSMENT: 


12/20/87 

ELEVON-123 

02-6-C01-A08 

ELEVON 

123 

HEATER 
R. WILSON 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


CRITICALITY REDUNDANCY SCREENS 


FLIGHT 




HDW/FUNC 

A 

B 

c 

NASA (3/3 ] 

[ NA] 

[ NA] 

[ NA] 

IOA [3/3 ] 

C NA] 

C NA] 

[ NA] 


CIL 

ITEM 


[ ] * 

[ ] 


COMPARE [ / 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] C ] 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/20/87 NASA DATA: 

ASSESSMENT ID: ELEVON- 12 4 BASELINE [ X ] 

NASA FMEA #: 02-6-C01-A09 NEW [ ] 

SUBSYSTEM: ELEVON 

MDAC ID: 124 

ITEM: HEATER 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 

CRITICALITY 

FLIGHT 

HDW/FUNC 

NASA [ 3 /1R ] 
IOA [3/3 ] 

COMPARE [ /N ] 


REDUNDANCY SCREENS 

ABC 

[ P ] [ P ] [ P ] 

[ NA] [ NA] [ NA] 

[ N ] [ N ] [ N ] 


CIL 

ITEM 


[ 1 * 

[ ] 

[ 1 


RECOMMENDATIONS: (If different from NASA) 

[ ] [ ] C ] t ] 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

-- ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. EXERCISING ACTUATORS OR CHANGING TO A 
THERMALLY-WARM ATTITUDE MAY NOT BE FEASIBLE . 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/20/87 

ELEVON-125 

02-6-C01-SW-C06 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ELEVON 

125 

SERVO ACTUATOR 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 


REDUNDANCY 

SCREENS 

CIL 


FLIGHT 

HDW/FUNC 


A 

B 



C 

ITEM 

NASA 

[ 2 

/1R ] 

[ 

P ] 

[ P 

] 

[ 

P 3 

[ x 

IOA 

t 2 

/1R ] 

[ 

P ] 

[ F 

] 

[ 

P 3 

C x 

COMPARE 

[ 

/ ] 

[ 

] 

[ N 

3 

[ 

3 

[ 

RECOMMENDATIONS : (If 

different 

from 

NASA) 




[ 

/ ] 

[ 

] 

[ 

3 

[ 

3 

[ 


(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA ANALYSIS. NO ISSUE. THIS IOA FMEA WAS WRITTEN 
FOR THE SERVO ACTUATOR. NOTE: IOA FMEA NO. 103 COVERS THE SAME 
NASA FMEA BUT FOR THE SWITCHING VALVE. 


REPORT DATE 02/03/88 
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APPENDIX D 
CRITICAL ITEMS 


1 


NASA FMEA 

MDAC ID 

ITEM 

FAILURE MODE 

02-6-C01-SW-C06 

103 

125 

Switch valve 

Leakage , 
gross external 

02-6-C01-SW-C02 

104 

Switch valve 

Fail to transfer 

02-6-C01-A01 

105 

115 

Servo actuator 

External leakage/ 
component rupture 
downstream of 
switch valve 

02-6-C01-CV-C08 

106 

Check valve 

Fail closed 

02-6-C01-CV-C09 

107 

Check valve 

Fail open 

02-6-C01-FE-B08 

108 

Filter 

Clogged 

02-6-C01-SV-B01 

109 

Servo valve 

Fails at null 

02-6-C01-SV-B02 

111 

Servo valve 

Fail hardover, 
on channel 

02-6-C01-PP-A06 

114 

Secondary Delta P 

Loss of output 

02-6-C01-PV-B05 

116 

Power valve 

Jammed 

02-6-C01-C06 

117 

Servo actuator 

Leaks external - 
complete 

elastomeric seal 
failure 

02-6-C01-PP-A07 

118 

Transducer- 
Piston position 

Loss of output 
of all four 
transducers 

02-6-C01-A02 

119 

Servo actuator 

Fracture - 
tailstock, 
rod end etc. 




APPENDIX E 
DETAILED ANALYSIS 


This appendix contains the IOA analysis worksheets supplementing 
previous results reported in STSEOS Working Paper 1. 0-SP-VA86001- 
07, Analysis of the Elevon Subsystem, (21 November 1986) . Prior 
results were obtained independently and documented before 
starting the FMEA/CIL assessment activity. Supplemental 
analysis was performed to address failure modes not previously 
considered by the IOA. Each sheet identifies the hardware item 
being analyzed, parent assembly and function performed. For each 
failure mode possible causes are identified, and hardware and 
functional criticality for each mission phase are determined as 
described in the NSTS 22206. Instructions for Preparation of FMEA 
and CIL. 10 October 1986 . Failure mode effects are described at 
the bottom of each sheet and worst case criticality is identified 
at the top. There were no supplemental analysis worksheets 
prepared for the Elevon actuator subsystem. 


LEGEND FOR IOA ANALYSIS WORKSHEETS 


Hardware Criticalities: 

1 = Loss of life or vehicle 

2 = Loss of mission or next failure of any redundant item 

(like or unlike) could cause loss of life/vehicle 

3 * All others 

Functional Criticalities: 

1R = Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of life or vehicle. 

2R = Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of mission. 


Redundancy Screen A: 

1 = Is Checked Out PreFlight 

2 = Is Capable of Check Out PreFlight 

3 = Not Capable of Check Out PreFlight 

NA = Not Applicable 


Redundancy Screens B and C: 
P * Passed Screen 
F = Failed Screen 
NA = Not Applicable 
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APPENDIX P 


NASA FMEA T0> IOA WORKSHEET CROSS REFERENCE/RECOMMENDATION 


This section provides a cross reference between the NASA FMEA and 
corresponding IOA analysis worksheet (s) included in Appendix E. 
The Appendix F identifies: NASA FMEA Number, IOA Assessment 

Number, NASA criticality and redundancy screen data, and IOA 
recommendations . 


Appendix F Legend 
Code Definition 

All initial IOA criticality and redundancy screen 
differences were agreed to with the NASA subsystem manager. 
In addition, the combining of like failures under one FMEA 
were agreed to. 
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